aws-glue-create-workload-as
Create a new Glue job bound to a passable privileged IAM role, then run it, to execute as that role.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?principal has EFFECTIVE glue:CreateJob (resource scope covers new job in target account/region)
?principal has EFFECTIVE glue:StartJobRun (or a trigger can start the new job)
?role trust policy allows glue.amazonaws.com as a service principal (or trust is unresolved)
iam:PassRole for ?role permits iam:PassedToService including glue.amazonaws.com (or unconditioned)
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?role |
| permissions | glue:CreateJob iam:PassRole glue:StartJobRun |
| conditions | iam_permission role_compatibility condition_expression |
| state logic | if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility). Elif principal has glue:CreateJob AND glue:StartJobRun AND iam:PassRole to glue.amazonaws.com is confirmed: ACTIVE. Else CONDITIONAL(iam_permission, role_compatibility) when one of the required actions is present but not fully confirmed. |
Narrative
{principal.name} can create a new Glue job (glue:CreateJob) bound to {role.name} (iam:PassRole to glue.amazonaws.com), then run it (glue:StartJobRun) to execute arbitrary code as {role.name}.
Raw rule rules/derived/aws/glue.yaml
id: aws-glue-create-workload-as
emits: CanCreateWorkloadAs
description: Create a new Glue job bound to a passable privileged IAM role, then run it, to execute as
that role.
applies_to:
- aws
match:
- - principal: null
- CanPassIdentity
- role: null
where:
- ?principal has EFFECTIVE glue:CreateJob (resource scope covers new job in target account/region)
- ?principal has EFFECTIVE glue:StartJobRun (or a trigger can start the new job)
- ?role trust policy allows glue.amazonaws.com as a service principal (or trust is unresolved)
- iam:PassRole for ?role permits iam:PassedToService including glue.amazonaws.com (or unconditioned)
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?role
permissions:
- glue:CreateJob
- iam:PassRole
- glue:StartJobRun
conditions:
- iam_permission
- role_compatibility
- condition_expression
state_logic: 'if ?role trust policy or iam:PassedToService is unknown/unresolved: POTENTIAL(role_compatibility).
Elif principal has glue:CreateJob AND glue:StartJobRun AND iam:PassRole to glue.amazonaws.com is confirmed:
ACTIVE. Else CONDITIONAL(iam_permission, role_compatibility) when one of the required actions is present
but not fully confirmed.'
confidence: min(contributing_confidences) * 0.95
derived_from:
- <CanPassIdentity(principal, role) edge_id>
false_positive_note: "Honor iam:PassedToService: a role passable only to ec2.amazonaws.com / ecs-tasks.amazonaws.com\
\ does NOT yield Glue execution. The role MUST trust glue.amazonaws.com or CreateJob fails (downgrade\
\ to POTENTIAL when trust is unknown). glue:CreateJob is folded as the CanDeploy-equivalent for Glue;\
\ no separate CanDeploy(principal -> Glue platform) edge is emitted. Do not emit when the principal\
\ lacks glue:CreateJob \u2014 that check is in the where-clause. This rule emits the create/bind step\
\ (CanCreateWorkloadAs); the execution consequence rolls up via can-execute-as execute-as-via-new-workload\
\ (cite, do not re-derive)."
narrative: '{principal.name} can create a new Glue job (glue:CreateJob) bound to {role.name} (iam:PassRole
to glue.amazonaws.com), then run it (glue:StartJobRun) to execute arbitrary code as {role.name}.'